Stability and topology of scale-free networks under attack and defense strategies 
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We study tolerance and topology of random scale- free networks under attack and defense strategies 
that depend on the degree k of the nodes. This situation occurs, for example, when the robustness 
of a node depends on its degree or in an intentional attack with insufficient knowledge on the 
network. We determine, for all strategies, the critical fraction p c of nodes that must be removed 
for disintegrating the network. We find that for an intentional attack, little knowledge of the well- 
connected sites is sufficient to strongly reduce p c . At criticality, the topology of the network depends 
on the removal strategy, implying that different strategies may lead to different kinds of percolation 
transitions. 

PACS numbers: 89.75.Hc, 87.23.Ge 



The observation that many real networks, such as the 
Internet, the WWW, social and biological networks etc, 
obey a power law distribution in their nodes connectivity 
has inspired a new area of research [IIHIM&IEIElIIsI- 
Such a network is constructed by nodes connected with 
links, where the probability P(k) that a node has k links 



is 



P(k) ~ fe- 



where 7 is usually found to be between 2 < 7 < 3. 

The scale- free character of these networks, represented 
by having no characteristic number of nodes per link, 
gives rise to many different and usually unexpected re- 
sults in many properties, as compared to lattice models 
or even to small- world networks 1]. One important fea- 
ture studied is the robustness of such a network under a 
random node removal |9j. In general, the integrity of a 
network is destroyed after a critical percentage p c of the 
system nodes has been removed. For scale-free networks 
it has been shown that p c = 1, i.e., in order to des troy 
the network practically all nodes have to be removed [10( . 

In this Letter, we consider scale-free networks where 
the robustness of a node depends on its connectivity. 
This means that the probability of damaging a node ei- 
ther by some kind of failure or by an external attack 
depends on the degree k of the node. Examples are com- 
puter networks and social networks. In a computer net- 
work such as the Internet, usually the hubs that serve 
many computers are built in a more robust way, so that 
their probability of failure is smaller than for the others. 
In a social network, members of a group that have more 
links to others have a lower probability of leaving the 
group. It is, however, also possible that nodes with more 
links are less robust. For example, traffic on a network 
induces high loads on highly connected nodes 01 > which 
in turn makes them more vulnerable to failures. In some 
cases breakdowns are due to cascades of failures caused 
by the dynamics of damage spreading |l2l | . In computer 



networks many breakdowns are due to congestion build- 
ing (see 0). 

The above examples represent internal properties of a 
network, where the vulnerability of each node depends 
on its degree. In addition, the probability of removing 
a node can depend on its degree also due to external at- 
tack strategy. For example, the most efficient attack is 
an intentional attack where the highest degree nodes are 
being removed with probability one. In this case, only 
a small fraction p of removed nodes is sufficient to de- 
stroy the network. This strategy, however, requires full 
knowledge of the network topology in order to identify 
the highest connected nodes. In many realistic cases, this 
information is not available, and only partial knowledge 
exists. Accordingly, in an intentional attack the high- 
degree nodes can be removed only with a certain proba- 
bility that will depend on k. In some networks, such as 
Terror or Mafia networks those that are higher in the hi- 
erarchy have more links and are less known, and therefore 
the probability to remove them is smaller than those with 
less links. In contrast, in normal social networks the sit- 
uation is opposite: The better linked members are more 
visible and therefore have a higher probability to be at- 
tacked. Finally, our study also applies to immunization 
strategies, where the high degree nodes are not always 
known in advance, see also Dezso and Barabasi [l^j . 

In all these examples, a value W(ki) is assigned to each 
node, which represents the probability that a node i with 
fej links becomes inactive either by failure or under some 
attack. Specifically, we focus on the family of functions, 

k a 

W(h) = — ^ , -00 < a < 00, (2) 

Eli kf 

The parameter a can be the sum of two parameters, 
a = a' + a", which incorporates both intrinsic network 
vulnerability (a') and external knowledge of the system 
(a"). It is possible that although some highly connected 
nodes are intrinsically vulnerable (a' > 0), an internal 



9 



defense strategy with a" < will give the net result 
a < 15}. In this case, nodes with lower k are more 
vulnerable, while for a > 0, nodes with larger k are more 
vulnerable. The cases a = and a — ► oo represent the 
known random removal 0, Ho| and the targeted inten- 
tional attack 0, , respectively. 

The choice of a can be related to the probability w 
that in each attack, one of the n highest connected nodes 
in a network of N nodes becomes inactive by failure or 
attack. By definition 

P(k)W(k)dk 

fZ~" P(k)W(k)dk 

where m denotes the minimum number and fc max ~ 
iV 1 /(7-i) the maximum number of links a node can have. 
k n is the minimum number of links of a node that belongs 
to the n highest connected nodes. It is easy to verify that 
for N ^> n ^ 1 , w is related to a and 7 by 

1 _ n (7-i-«)/(7-i) m «+i-7 

W ~ 1 _ 7V(7-l-a)/(7-l) TO a+l-7 ^ ' 

Depending on the value of cv, for fixed value of 7, we can 
distinguish 3 different regimes. 

(i) a > 7 — 1: Here, w = 1, and an "attacker" is capable 
of destroying all the highest nodes in the network. Even 
though a is finite here, this case is fully equivalent to the 
targeted intentional attack a — > 00. 

(ii) a = 7 — 1: For this particular value of a, w depends 
logarithmically on n and N, w = lnn/lniV. 

(iii) a < 7 — 1: Here, w decreases with n/N by a power 
law, w — (n/A) 1 ^"/^ 7-1 ). A special case is a = 0, where 
effectively nodes are picked randomly and thus w = n/N . 
In this case, it is difficult to destroy the network, and the 
percolation threshold p c can even be p c = 1 for well- 
connected networks (7 < 3) [U 0] . For < a < 7 — 
1, the effective removal is better than random; w still 
approaches zero for N approaching infinity, but less fast 
than in the random case. As is shown later, this is enough 
for the percolation threshold to be significantly smaller 
than 1. Finally, for negative values of a, the fraction 
w of the highest connected nodes that will be damaged 
decreases much faster than in the random case. This 
feature will have no effect on the percolation threshold 
for 2 < 7 < 3, where p c = 1 already in the random 
case. But for 7 > 3, p c increases with increasing negative 
values of a, as we show below. 

From the above discussion it is clear that the regime 
a > 7 — 1 is in the same universality class as the inten- 
tional attack, and a = is identical to the random attack. 
It is not clear if there are more universality classes and 
if not, what is the border line between them. To study 
this question, we have considered both numerical simula- 
tions and analytical considerations. First we determine 
the percolation thresholds as a function of the network 
parameters 7, TV and m, and on the 'attack' parameter 




FIG. 1: The ratio of non-spanning configurations vs the frac- 
tion of removed nodes p. Lines are simulation data, from net- 
works oi N = 10 6 nodes, while the circles are the theoretical 
critical points, a) Results from 100 different realizations of 
networks with 7 = 2.5. Left to right: a— 4, 1, 0.5, 0.25 and 
0. b) Results from 300 realizations of networks with 7 = 3.5. 
Left to right: a=4, 1, 0.5, 0, -0.5, and -1. 

a. Then we study the universality classes by analyzing 
the topology of the network at these thresholds. 

In the numerical treatment and the analysis we use 
random mixing for the network construction, where no 
correlations exist between the connectivity of neighbor- 
ing sites. We first construct the network for a given 7. 
We fix the number of nodes N, as well as m and as- 
sign the degree k (number of links) for each node by 
drawing a random number from a power law distribution 
P(k) ~ fc -7 . We then randomly select pairs of links be- 
tween nodes that have not yet reached their preassigncd 
connectivity and have not already been directly linked 
to each other. We repeat this selection until the entire 
network has been created. 

To find the percolation thresholds p c , we choose suc- 
cessively nodes with probability W(k) (see Eq. EJ and 
remove them. When a node is removed all its links are 
cut. After each removal, we calculate (k 2 ) and (k). If 
K = (k 2 )/(k) > 2, a spanning cluster exists in the net- 
work. We repeat this procedure for a large number of 
configurations (typically 100-300). For each concentra- 
tion p of removed nodes we determine the probability 
F x that a spanning cluster does not exist. We obtain p c 
from the condition i 7 ^ = 1/2, as is shown in Fig. ^ for 
7 = 2.5 and 3.5 and several a values between 4 and -1. 
The width of the dispersion in i 7 ^ gives an upper bound 
for the error bars for p c . 

In the analytical treatment, we assume that sites are 
chosen for deletion according to their initial connectivity. 
A site is chosen with probability k a /N(k a ). After d dele- 
tion attempts, the probability that a site of connectivity 
k has not been deleted is 

The condition for the existence of a spanning cluster after 
the attack is as follows: a site is reached through a link 




FIG. 2: (a) Values of p c vs 7 for different a values: (bottom 
to top) a = 4, 1,0.5,0, —0.5, — 1. Symbols represent simula- 
tion data (N = 10 6 nodes) from 100 — 300 different network 
realizations. Solid lines are the theoretical predictions for 
finite-size networks, while dashed lines correspond to infinite- 
size networks. Lower cutoff: m — 1, (b) Values of p c vs a 
for infinite-size networks and different 7 values. Lower cutoff 
m = 1 (c) Same as (a), with lower cutoff: m = 2, and (d) 
Same as (b), with lower cutoff: m — 2. 



with probability kP{k) / (k) and is still functional with 
probability p(k). If the average number of outgoing links 
(k — 1) per site is larger than 1, a spanning cluster will 
exist. This consideration is formulated by: 



E 



p{k)k(k - 1) 
W) ' 



-q c k a 



(6) 



where q = d/N(k a ), and q c is the value of q at criticality. 
To find the fraction of removed sites, one numerically 
solves Eq. 10 to calculate q c and substitutes this value 
for calculating the critical threshold of removed sites: 

femax 

p c = J2 p ( k )p( k ) = E p ^ e M-q c k a ) . (7) 

k—m 

Equation 10 describes the percolation threshold p c for 
a given network of N nodes with exponent 7, as a func- 
tion of the attack parameter a. 

The lines in Fig. represent the solutions of Eqs. © 
and (JZJ) and are in excellent agreement with the simu- 
lations (in symbols). Remarkably, for 7 < 3, p c be- 
comes smaller than 1 already for very small positive a 
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FIG. 3: Average shortest distance (I) between any two nodes 
of the giant cluster at criticality as a function of the clus- 
ter size N c . The results correspond to networks of initially 
N — 10 4 , 10 5 , and 10 6 nodes. 1000 different configurations 
have been used for each N, except for TV = 10 6 (100 configu- 
rations). The data have been logarithmically binned, and the 
results have been vertically shifted for presentation clarity. 
The values of a and 7 are shown in the plot. The lines repre- 
sent the theoretical slopes of (top to bottom): 1/2, 1/3.5, 1/3, 
and 1/2.33, respectively. Inset: Semi- logarithmic plot for the 
case of 7 = 2.5 and a = 0. 



values, and decays rapidly with increasing a. Accord- 
ingly, by a very small preference probability to remove 
highly connected nodes, which arises, for example, in 
an intentional attack with very little knowledge of the 
network structure, this network can be destroyed by re- 
moving a comparatively small fraction of nodes. Above 
a = 7 — 1, p c saturates, which means that the knowl- 
edge available to the attacker in this case is sufficient to 
destroy the network most efficiently. From Figs. 2a and 
c one might conclude that negative values of a might 
lead to p c — 1 also for 7 values above 3. We tested this 
question numerically and found that for all values of 7 
values between 3 and 4 and negative a, the percolation 
threshold p c is below 1. For large negative values of a 
and 7 > 3, the critical threshold can be approximated by 



l-( 7 -l) 



Pc 



all 7 > 3 and m > 2. 



m 



2- 7 



which is below 1 for 



To study the effect of the different attack strategies on 
the topology of the network just before disruption, we 
analyzed the topology of the network at the percolation 
transition for different values of 7 and a. We characterize 
the topology by the way the average shortest topological 
distance (I) between two nodes scales with the cluster- 
size N c . We expect that N c scales with (I) as N c ~ 
(l) de , where di is the topological ("chemical") dimension. 
Using a mean- field type approximation Ref. |lfjl| . it has 
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been suggested that for random removal, 

d e = ^l 7 3< 7 <4, (8) 
7-3 

while for the intentional attack 

d e = 2 , 7 > 2. (9) 

The power-law dependence (I) ~ N^ dl is very differ- 
ent from the logarithmic dependence (I) ~ log TV found 
in scale- free networks for p well above p c and 7 > 3. 
Accordingly, due to the attacks, the network becomes 
very inefficient, since the distances between the nodes 
increase drastically, from a logarithmic to a power-law 
dependence on the total number of nodes. Equations 
(8) and (9) suggest that random removal and intentional 
attack are in different universality classes. This implies 
that the critical properties of the percolation transition 
depend on the way the transition is being approached, 
which is quite unusual in critical phenomena. To test 
these predictions and to see if there are further univer- 
sality classes, we studied numerically how, at criticality, 
(I) scales with N c , for different networks and different 
attack parameters a. 

Figure 3 shows simulation results for (I) as a function 
of N c for several values of 7 and a. For a > 0, the 
data scale quite nicely and yield a slope very close to 
1/2 (corresponding to di = 2) for all 7 values, being 
identical to the theoretical prediction, Eq. ©, for the 
a = 00. This shows that all attacks with a > fall 
into the same universality class. The figure also verifies 
the prediction of Eq. (JSJ) for random removal (a = 0) 
when 7 > 3. It shows, in addition, that attacks with 
a < result almost in the same network structure as for 
a = 0, and yield the same topological dimension. Thus, 
for a given network with 7 > 3 the same network can 
undergo transitions of two universality classes: a) a > 
(universality class of the targeted intentional attack), and 
b) a < (universality class of random removal). 

For 2 < 7 < 3 and a < 0, the situation is less conclu- 
sive. Here, it is difficult to distinguish between a logarith- 
mic or a power-law dependence, as can be seen from the 
inset of Fig. 3. Since for the pure network, (I) ~ log log N 
[lif . also a simple logarithmic dependence (I) ~ log AT 
will lead to a strong increase of the mean distance be- 
tween the nodes at criticality, as suggested by the inset. 

In summary, we have studied the network tolerance un- 
der different attack strategies. We find that little knowl- 
edge on the highly connected nodes in an intentional at- 
tack reduces the threshold drastically compared with the 
random case. For example, when in a scale-free network 
with 7 = 2.5 the one percent highest connected nodes 
are known with probability w — 0.2 (corresponding to 
a = 1), the threshold reduces from p c = 1 for the ran- 
dom case (w — 0) to p c = 0.25. When all hubs are 
known (w = 1), p c is close to 0.07. This shows that for 



example the Internet (see also |Tjj) can be damaged ef- 
ficiently when only a small fraction of hubs is known to 
the attacker. Moreover, this result is also relevant for 
immunization of populations: Even if the virus spread- 
ers are known (and immuned) with small probability, the 
spreading threshold can be reduced significantly. We also 
showed that even if the attack does not yet disintegrate 
the network, there is nevertheless a major damage on the 
network, since the distances between the nodes increase 
significantly and any transport process on the net may 
become inefficient. Our results show that the topology 
of the network close to criticality, characterizing the uni- 
versality class of the phase transition, depends on the 
strategy of node removal. 
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by the Israel Science Foundation. 
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